Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d06cc416 authored by Johan Hedberg's avatar Johan Hedberg Committed by Gustavo Padovan
Browse files

Bluetooth: Fix deadlock and crash when SMP pairing times out 



The l2cap_conn_del function tries to cancel_sync the security timer, but
when it's called from the timeout function itself a deadlock occurs.
Subsequently the "hcon->l2cap_data = NULL" that's supposed to protect
multiple calls to l2cap_conn_del never gets cleared and when the
connection finally drops we double free's etc which will crash the
kernel.

This patch fixes the issue by using the HCI_CONN_LE_SMP_PEND for
protecting against this. The same flag is also used for the same purpose
in other places in the SMP code.

Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
parent 4c47d739

net/bluetooth/l2cap_core.c

+6 −1
Original line number Original line Diff line number Diff line
@@ -1295,8 +1295,13 @@ static void security_timeout(struct work_struct *work) 
	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,

	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,

						security_timer.work);

						security_timer.work);





	BT_DBG("conn %p", conn);



	if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {

		smp_chan_destroy(conn);

		l2cap_conn_del(conn->hcon, ETIMEDOUT);

		l2cap_conn_del(conn->hcon, ETIMEDOUT);

	}

	}

}





static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)

static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)

{

{